Canadian Phish Kits Reactivated as Tax-filing Deadlines are Moved

The COVID-19 Effect on Economy

The economic pain being caused by the COVID-19 pandemic is taking a big toll on a global scale and governments are not exempted by this crisis. Many governments around the world are moving their tax-filing deadlines and lifting late penalties to help their citizens cope up with the situation.

In Canada for example, the tax-filing deadline has been moved from April 30, 2020 to June 1, 2020 and also giving a penalty-free extension to Canadian taxpayers, including businesses, until August 31, 2020 to pay for taxes owed.

This move from the government appears to have gained phishing interests leading to a reactivation of an old phishing kit, which targets taxpayers who are expecting refunds from tax returns.

An Old Phish Kit

We recently came across a zip archive that was named “covid.zip” uploaded to a malicious site, which upon taking a closer look contains phishing pages targeted to taxpayers wanting to deposit their tax refunds to affiliate banks in Canada. This particular phish kit is known to have existed since 2018, but even though it is old, it still poses a threat to the users of the affiliated banks.

Figure 1.0 The covid.zip package contents (hxxps://amelzendez.com/covid.zip – 869e7dc7c2897e13385d6a26f348858b9f83321702eba383bd3381b7cd3d485e)

The index.htm component leads to a welcome page with an option to choose either English or French version, both options lead to a selection of associated Canadian banks where users can supposedly deposit money from their tax refunds.

Figure 2.0 Phishing Welcome Page

Figure 2.1 Affiliated banks selection page

Most of the phishing pages attempt to steal bank account details from taxpayers by luring them into updating their bank account profiles or personal information.

Figure 3.0 National Bank Phishing Page – Banking Profile Update Page

In one of the phishing pages, disguised as Alberta Treasury Branches’ (ATB) online banking page, personally identifiable information (PII) stolen by asking victims to confirm their personal information including their Social Insurance and Driver’s License numbers. A clear phishing indicator, however, should raise users’ suspicion that they are not on a legitimate online banking site when bank card information such as the CVV2 and ATM PIN as asked for, as also seen from the ATB phishing page.

Figure 4.0 Alberta Treasury Branches Phishing Page – Personal Information Update Page and Card Information

Most of the target bank websites are mirrored with a third-party tool and stolen information are sent to an email address, which is set in a configuration file for each targeted bank.

Figure 5.0 Configuration File

We highly recommend people to be very mindful of clicking links in emails and text messages and always check if the online banking websites they are visiting are legitimate by inspecting site security information on their browsers. It is also very important to keep your personal information safe at all times by knowing which information you only need to and can provide online.

Indicators of Compromise

Phishkit

hxxps://midiaplural.com.br/covid.zip 
 hxxp://midiaplural.com.br/covid.zip 
 hxxp://thechristianwardrobe.us/covid.zip 
 hxxps://amelzendez.com/covid.zip 
 hxxp://amelenedez.com/covid.zip 
 hxxps://amelenedez.com/covid.zip 
 hxxp://www.amelenedez.com/covid.zip 
 hxxp://amelzendez.com/covid.zip 
 hxxps://amqelendez.com/covid.zip 
 hxxp://amqelendez.com/covid.zip

Latest phishing sites

hxxp://whizkidtoys.com/wp/vraitax%20(2)/vraitax/tax/96322/tax/taxb/atb/login.aspx 
 hxxp://jevn.in/wp/vraitax%20(2)/vraitax/tax/96322/tax/taxb/cibc/index.php 
 hxxps://nombolepome.com/df/vraitax%202/vraitax/tax/96322/tax/taxb/bmo/index.php 
 hxxp://zeuohed.com/wp/tax/taxb/bnc/National%20Bank%20Online.html 
 hxxp://jevn.in/wp/vraitax%20(2)/vraitax/tax/96322/tax/taxb/cibc/index.php 
 hxxps://avdeeff.ca/wp/vraitax%20(2)/vraitax/tax/96322/tax/taxb/desj/index2.php 
 hxxp://shopoliverz.ch/wp/vraitax%20(2)/vraitax/tax/96322/tax/taxb/rbc2 
 hxxp://astrologicalshop.com/canda/vraitax%20(2)/vraitax/tax/96322/tax/taxb/sco/index.php 
 hxxp://occurator.com/wl/tax/tax/taxb/td

Related Detections